N434FX – EMBRAER S A EMB-545 – 2023-09-21 NTSB Accident Report

HISTORY OF FLIGHTOn September 21, 2023, about 1436 eastern daylight time, an Embraer SA EMB-545 MOD airplane, N434FX, operated by Flexjet LLC as Flexjet flight 434, was substantially damaged when it was involved in an accident near St. Simons Island, Georgia. The pilot, copilot, and the six passengers were not injured. The airplane was operated as a Title 14 Code of Federal Regulations (CFR) Part 91K fractional flight.

The airplane departed Westchester County Airport (HPN), White Plains, New York, at 1239 destined for St. Simons Island Airport (SSI), St. Simons Island. According to the flight crew, the departure and en route phase of the flight were uneventful, and they performed the checklists in accordance with procedures. The pilot (who was flying from the left seat) stated that he chose to fly the GPS runway 4 approach (versus flying a visual pattern) to allow more time for alignment and setup for landing. He said that he selected the “flaps 3” configuration due to the gusting wind component to be prepared in case it shifted to a crosswind and that the autothrottle was in use.

The copilot said they had the runway in sight from 10 miles out, and he made the “500-ft stable, 20-kt headwind” callout when the airplane was descending through 500 ft agl. The NTSB airplane performance study determined that the FDR data and CVR audio for the airplane were consistent with a stable approach up to this point. The flight crew reported that all checklists and callouts were conducted. The FDR data showed that the fly-by-wire system was operating in normal mode, and the airplane’s autopilot was disconnected at 1435:49, when the airplane was about 500 ft.

The pilot said that, when the airplane was about 100 to 150 ft agl, it crossed over a tree line, and he felt an “uplift,” then the airplane began to porpoise. The pilot tried to make pitch corrections using the sidestick control, but the airplane did not respond as commanded.

The copilot said that the airplane was over the runway displaced threshold when it started pitching up and down. He looked over at the pilot’s hand on the sidestick, and he could see the pilot moving it back and forth in what seemed to him to be ”very aggressive” inputs. The copilot then said something like, “Take it easy there,” and the pilot replied that the airplane was not responding.

The copilot estimated that the airplane was about 50 ft above the runway when he asked the pilot something along the lines of, “Would you like me to try?” The copilot said that he pulled back on his sidestick, and it felt like nothing happened. The copilot said that, at this point, it seemed like they were “along for the ride” and that he needed to brace himself for impact.

The NTSB airplane performance study determined that, about 1436:19 (13 seconds before touchdown), when the airplane was about 162 ft radio altitude, the airplane’s AOA increased suddenly, likely due to a wind gust. The airplane’s AOA limiter protection system (aerodynamic stall prevention system) engaged, and the airplane’s AOA reduced. The FDR data for the pilot’s sidestick control showed that the pilot provided airplane-nose-up and airplane-nose-down pitch commands (as well as roll commands) and that the AOA limiter protection, which remained engaged until touchdown, limited the airplane’s response to the pilot’s pitch commands. (See the Tests and Research section for more information about the NTSB airplane performance study and systems functions during the accident flight.) In their postaccident statements, neither flight crewmember indicated any awareness that the AOA limiter protection had engaged.

The CVR transcript showed that, at 1436:28 (4 seconds before touchdown), the flight crew received a terrain awareness and warning system (TAWS) “sink rate” aural alert and reacted in surprise. During the 3 seconds before touchdown, the pilot commanded full airplane-nose-up pitch, and the fly-by-wire control system responded with about 3° airplane-nose-up elevator (full elevator deflection ranges from 25° up to 15° down). During the flare, the airplane was subjected to a horizontal gust which which resulted in a reduction of about 8 kts of indicated airspeed. During the 1.5 seconds before touchdown, the copilot also commanded full airplane-nose-up pitch, and the system responded with 5.5° airplane-nose-down elevator about 0.5 second before touchdown. The airplane impacted the ground at 1436:32.

The copilot said that the airplane touched down “hard” before the runway threshold on centerline, and he thought that it bounced and then touched down again. He said the airplane was listing and drifting to the right as it skidded down the runway. The copilot remarked to the pilot that the airplane was not decelerating very much, and the pilot said that he was trying to get it stopped. The copilot then pulled the emergency brake handle, but nothing happened, so he put it back down.

The airplane then went off the right side of the runway, hit a concrete base for a sign, then skidded mostly sideways before coming to rest on the grass to the right of the runway. After the airplane came to a stop, the copilot opened the cockpit door to check on the passengers and advised the pilot to shut down the engines so he could open the cabin door and deplane the passengers. The pilot shut down the engines, and all occupants deplaned through the main cabin door. PERSONNEL INFORMATIONThe pilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land and sea. He also held type ratings on the BE-300, BE-400, CE-560XL, CE-650, CL-600, EMB-550, HS-125, and MU-300. He possessed a flight instructor certificate with ratings for single-engine and instrument airplanes, a ground instructor certificate with ratings for advanced and instrument, and a remote pilot certificate for small unmanned aircraft systems. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 10,900 total flight hours, with 1,872 hours in the accident airplane make and model.

The copilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land. He also held type ratings on the A-310, A-320, B-757, B-767, DC-9, DC-10, EMB-550, and LR-JET. Additionally, he also held a flight engineer certificate with a rating for turbojet-powered. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 16,686 total flight hours, with 306 hours in the accident airplane make and model. AIRCRAFT INFORMATIONThe accident airplane was manufactured in 2020. Its most recent continuous airworthiness inspection was completed on April 11, 2023, at 2,863 total hours of operation. At the time of the accident, the airplane had accrued about 3,424 hours of operation. Flexjet reported no deferrals per the airplane’s minimum equipment list, and a review of the discrepancy history for the airplane for the preceding year revealed no discrepancies related to the accident.

The Embraer EMB-545 MOD airplane, which requires a minimum two-pilot crew, is a low-wing, T-tail, pressurized airplane powered by two high bypass-ratio Honeywell International rear-mounted turbofan engines. The fully retractable tricycle landing gear is designed to be operated on paved runways only. The instrument panel uses a glass cockpit concept with the Collins Pro Line Fusion avionics system consisting of four display units (left, center, right, and lower). The operation is based on the use of the flight management system and is equipped with an autopilot, flight director, and autothrottle. The accident airplane’s avionics included a Honeywell TPM-6000 TAWS module configured with the reactive windshear feature disabled.

By design, the fly-by-wire flight control system provides closed-loop control and monitoring of all primary and secondary flight control surfaces within the system. The normal mode is designed to provide improved flying handling qualities and reduce flight crew workload. In direct mode, the airplane behaves like a conventional airplane, such that the sidestick and pedal deflections are directly related to the control surface position.

AOA Limiter Protection System

As outlined in detail in the NTSB Systems Group Chair’s Factual Report, available in the public docket for this accident, the airplane’s AOA limiter protection system is designed to prevent the airplane from entering an aerodynamic stall condition. To accomplish this, the fly-by-wire flight control computers apply control laws to the pilot’s pitch commands on the sidestick to position the elevators as required to prevent the airplane from exceeding the maximum AOA limit. The maximum AOA limit is designed to provide adequate airplane roll maneuverability, good flight characteristics, and sufficiently safe margin to the aerodynamic stall AOA.

The AOA limiter protection engagement, which depends solely on AOA, engages when the AOA becomes greater than a given value, which is predetermined for each airplane configuration (for example, gear position, flap setting, or icing conditions) and may be reduced in case of significant AOA rate of change.

Normally, the airplane’s maximum AOA limit is reached at lower speeds, but the AOA limiter protection may engage due to maneuvers that increase the load factor or a sudden AOA increase due to wind gusts. The fly-by-wire control laws are designed so that when the airplane flies in normal mode (such as during the accident approach), its AOA will not exceed the maximum AOA limit, even if the pilot holds the sidestick control fully aft.

Based on the flight control computer software version that was current at the time of the accident and installed on the accident airplane (FCC software load Build 3), once the AOA limiter protection is engaged, it will automatically...